Play Framework

fix(server): bound staticPathsCache to prevent PROD heap-growth DoS (PF-126)

Replace the unbounded ConcurrentHashMap with a Caffeine cache capped at
maximumSize(10_000). The key includes the client-controlled Host header and
Router.routeOnlyStatic throws RenderStatic for any staticDir-prefixed path
regardless of file existence, so an unauthenticated client could previously
grow the map without bound until heap exhaustion. Read/write semantics are
preserved (getIfPresent returns null on miss, like Map.get).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
(cherry picked from commit aba47f30b042ecf13e07429c63ffbba09d13d379)